# Bootstrap Role

First-time setup for a fresh Debian/Ubuntu server. Run once, against the
server's public IP (inventory group `bootstrap`, host `netcup`), before
`site.yml` can reach it over Tailscale.

## What it does
- Installs `aptitude`, `curl`, `vim`, `git` and `ufw`.
- Gives the `sudo` group passwordless sudo.
- Creates the user `created_username` (set to `phil` in `bootstrap.yml`) in
  the `sudo` group, with your local `~/.ssh/id_ed25519.pub` as its SSH key.
- Sets `PermitRootLogin prohibit-password` (root can still log in with a key).
- UFW: allows OpenSSH, enables the firewall with default deny.

`bootstrap.yml` then runs the `artis3n.tailscale` role to join the tailnet,
using `vault_infrastructure.tailscale_key` from the vault.

## Requirements
- `ansible-galaxy install -r requirements.yml` (for `artis3n.tailscale`).
- `~/.ssh/id_ed25519.pub` on the machine running Ansible.
- Root (or another sudo user) SSH access to the new server.

## Usage
```bash
.venv/bin/ansible-playbook bootstrap.yml -i hosts.yml --vault-password-file vault_pass
```

Once the server is on Tailscale, put its Tailscale IP in `hosts.yml` under
`docker` and use `bin/deploy` from then on.